Privacy Policy

Last updated: 01/07/2026

This policy explains how we use your personal data when you book, stay at our property or contact us, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

1. Data controller

ASTRAKIANAKIS EMMANOUIL NIKOLAOU (Dorado Accommodation) 114584680 Albert 7, Heraklion, 71201 info@dorado.gr · +30 693 180 35952.

2. Data Protection Officer (DPO)

Emmanouil Astrakianakis, Entec Consultants, 36 Archiepiskopou Makariou St., Heraklion, Greece · email: e.astrakianakis@entec.gr · phone: +30 6976 40 60 40. You may contact the DPO about any matter relating to your data and the exercise of your rights.

3. What data we collect

• Identity and contact details: full name, email, phone number, address, country.
• Booking details: dates, number of guests, accommodation type, price, special requests.
• Payment and invoicing details. Card details are processed by payment providers; we do not store them.
• Correspondence with us (email, messages, phone).

4. Why we use it and on what legal basis

Purpose

Legal basis (GDPR)

Booking, stay, booking-related communication

Performance of a contract (Art. 6(1)(b))

Invoicing and keeping tax records

Legal obligation (Art. 6(1)(c))

Security, fraud prevention, establishing or defending claims

Legitimate interest in protecting you and our business (Art. 6(1)(f))

Newsletters and offers

Consent (Art. 6(1)(a)), which you can withdraw at any time

Without your booking details we cannot complete your booking. We do not use automated decision-making or profiling.

5. Who receives your data

• The provider of our property management system and the website booking engine.
• Booking platforms (e.g. Booking.com, Airbnb, Expedia), when you book through them.
• Payment providers and banks.
• Our accountant and partners supporting the operation of the property, only as needed.
• Public authorities, where required by law (e.g. tax authorities).

Our partners process data only on our instructions and are bound by confidentiality. If a provider is located outside the EEA, data is transferred only on the basis of a Commission adequacy decision or appropriate safeguards (e.g. standard contractual clauses).

6. How long we keep it

• Booking data and invoices: at least 5 years from the end of the tax year, or as long as tax law requires.
• Correspondence not related to a booking: up to [24] months.
• Newsletter data: until you withdraw your consent.
• If a dispute is pending, until it is finally resolved.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection and data portability. Where processing is based on consent, you can withdraw it at any time. Contact the DPO (section 2); we will reply within one month.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 11523 Athens, Greece, www.dpa.gr.

8. Security

We apply technical and organisational measures, such as two-factor authentication and restricted access. We will never ask for card details or passwords via WhatsApp, Viber, SMS or an email link. If you receive such a message, contact us using the official details in section 1.